PT-2026-61629 · Datacycle Engine · Datacycle-Core
CVE-2026-32823
·
Published
2026-07-20
·
Updated
2026-07-20
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through
GET routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to GET, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal Standard account: a cross-site-style GET to watch lists/:id/add item?thing id=... inserted content into a watch list with no CSRF token. Additional GET mutation routes exist in the codebase, including user impersonation for authorized admins and cache or
translation state changes. This is patched in version 26.06.08.Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Datacycle-Core